Privacy Policy

Spence is a personal finance app. This policy explains what data the app handles, where it goes, and the choices you have. Short version: your financial data is encrypted on your phone before it is uploaded, and we cannot read it.

1. Data the app handles

• Expenses, budgets, trips, assets and the financial profile you enter (amounts, merchants, dates, categories, notes, places, itemized lines, mortgage/car/income details).
• Receipt photos, PDFs and screenshots you scan or share into the app (including online-order pages and emails), price tags you photograph, and your optional profile and cover photos.
• Files you choose to import: a spreadsheet of expenses or your Amazon order-history file. They are read on your phone; only the expenses you choose to save are kept, encrypted like the rest. Utility billing histories (spreadsheets from an electric, gas, water or internet company) are read the same way. Only when a file's layout can't be worked out on the phone, its file name, column names and first few rows (long numbers such as account numbers hidden) are sent once to Gemini to tell which column is which.
• Account data: your email address and sign-in identifier (Firebase Authentication) and, if you use shared spaces, your display name.
• Purchase data: your subscription status from Google Play Billing. To confirm a subscription really belongs to your account, the app sends its Google Play purchase token to our server, which asks Google Play for the plan, renewal state and end date and keeps only those, under your account id; Google Play also tells our server when a subscription renews, is cancelled or ends. We never see your payment card.
• Diagnostics: crash reports and basic usage analytics (Firebase Crashlytics and Google Analytics for Firebase, with the advertising ID and ad personalization turned off), and a push-notification token for invitations and shared-space updates (stored under a one-way hash), and the number of AI actions used this month (a bare count under a one-way hash of your account id, so clearing app data does not reset your monthly allowance).

2. End-to-end encryption

• Expenses, trips, assets, settings and financial-profile data are encrypted on your device (AES-256-GCM) with a key that is never stored in our database. The database holds only encrypted blobs and a timestamp.
• The key stays in your phone's secure hardware-backed storage and in Google Block Store (encrypted with your screen lock). Because of this, we cannot recover your data if you lose both your device and your recovery key. You are asked to save a recovery key when you create your account.
• Receipts are encrypted before upload. On the free plan the cloud copy of a receipt photo is smaller, the cloud keeps only your newest 100 receipt photos (older cloud copies are deleted, the photo on your phone and the expense stay) and at most 60 are uploaded a month; paid plans keep them all. Shared spaces (family, roommates, trips) use a separate key that is passed only between members, encrypted to each member's own key. Space names, member names and invite details are encrypted too.
• Account emails. We email your account address only about the account itself: a welcome message when it is created (with a link to delete the account if it was not you) and a notice when it signs in on a new device (the time and the phone model). They are sent over Google mail servers, the address is read from the sign-in record when the message goes out and is not stored anywhere else.
• Some technical identifiers must stay readable so the service works: account and space IDs, membership lists, invite status and modification times.
• Optional app lock: a PIN (stored only as a salted hash on your device) and backup codes.

3. AI features

When you use an AI feature, the relevant text or image is sent to Google's Gemini models through Firebase AI Logic, in readable form, only for that request, to produce a result for you. We do not use it to train models or build profiles, and it is not stored in our database in readable form. Google processes it under its own terms. If you prefer not to use AI, enter expenses manually; the offline scanner and most insights work without it. AI features are:

• Scanning a receipt, ticket, booking, online-order page or email, PDF or price tag, or a document you share to set things up (a pay stub, a lease, a mortgage, car loan or insurance statement): the image or text you scanned or shared. Documents are read on your phone first; Gemini sees one only when the phone can't read a needed figure.
• Split bills and tips: when a receipt shows a payment split, the receipt image may be read once more to find a handwritten tip. You confirm the split before anything is saved.
• Typed or spoken entry ("coffee 4.50 yesterday"): the sentence you entered.
• The Spence assistant: your question, plus only the items it looks up on your phone to answer it (not your whole history), and the short notes you asked Spence to remember (stored end-to-end encrypted with your settings; you can see and delete them in Settings). Spence changes your data only when you tap Apply on a card it shows you.
• Monthly recap: on paid plans, a one-paragraph summary of a finished month is written by Gemini from the figures the app worked out (totals by category, changes), not from your expenses themselves; it is kept on your phone.
• Recurring bills: to show what kind of spending each repeating bill is (utilities, entertainment and so on), the name of a bill the app can't place by itself is sent once; the answer is kept on your phone.
• Categorizing imported orders: when you import an Amazon order history, only product names the app cannot categorize by itself are sent; never amounts, dates, addresses or payment details. Each import uses a small number of requests.

AI use is limited by a monthly allowance that depends on your plan.

Smart shopping and your prices

"Your prices" (your own inflation), "Smart shopping" (where you could pay less), month-by-month Insights and your tips history are worked out on your phone from your own receipts. To recognize the same product at different stores (for example "KS ORG BANANA" and "Organic Bananas", or the same adhesive bought at two stores), the app sends Gemini only product names and store names it has not seen before, each once, never amounts, dates, places or anything about you; the answers are kept on your phone. The monthly written summaries are produced by Gemini from the computed figures only.

Price Watch

Prices you photograph in stores to follow over time are stored like your expenses: end-to-end encrypted with your key, tag photos encrypted before upload. They are never counted as spending. If you share a watched item with a space, it is encrypted with that space's key and only its members can read it. The photo is read by Gemini to find the product and price, as with receipt scanning.

Trips and places

Trip maps are drawn on your phone from a map built into the app; no map service sees your trips. To place a receipt's address on the map, the app uses your phone's built-in address lookup (on most Android phones this is a Google service, which receives the address text only). Results are kept on your phone. Suggestions for your home city are built into the app.

Store logos

Store logos are downloaded from our storage. If "Show store logos" is on (Settings, on by default) and a store you use has none, the app adds that store's name to a shared request list, once, with no account, amount or date attached, so popular stores get logos.

Help improve receipt scanning (optional, off by default)

If you turn on "Help improve receipt scanning for everyone" in Settings, what the AI learned about a store's receipt (the store's name, its item names and their categories) is shared so other people's scans at that store work better. Never amounts, dates, quantities or anything you typed. Each contribution is stored under a one-way code that cannot be linked to your account or to your other contributions.

Auto-add purchases from card and wallet alerts (optional, off by default)

If you turn on "Auto-add purchases" and allow notification access, Spence reads notifications from the bank, card and wallet apps you pick (for example Google Wallet or your card issuer's app), and only those. When one reports a purchase, Spence keeps the amount, the store's name, the card's last 4 digits and the time, and offers it as an expense for you to confirm. The rest of the notification's text is read in memory and dropped: messages, one-time codes and balances are never kept, logged or sent anywhere. Purchases waiting for your answer stay on your phone; nothing from your notifications is sent to our servers or to anyone else. An expense you add is end-to-end encrypted and synced like any other. You can turn this off in the app or in Android's notification access settings at any time.

Community prices (optional, off by default)

If you turn on Community prices, once a month your phone shares anonymous store prices (from your receipts and the price tags you capture in Price Watch) so everyone can see where things cost less nearby. Each shared price contains only: the product (a generic name), the store chain, the store's city, the price per pound, litre or piece, and the month. It is one value per product, store and month, so how often or how much you buy is not revealed. It never contains your account, name, email, what you spent, quantities, dates, receipts, or the set of stores you use; shared prices carry no user identifier and cannot be linked to you or to each other. They go to a drop box no app can read; our server combines them into medians and deletes them, and a price is shown to others only when at least 5 contributions back it. Because they are not linked to you, prices already shared cannot be singled out or deleted later; turning the option off stops any further sharing. Your own expenses remain end-to-end encrypted either way.

4. How we use data

To run the app: sync your data across your devices, share spaces you create, send invite notifications, provide subscriptions, prevent abuse and fix crashes. We do not sell your data, show ads, or share it for advertising.

5. Service providers

Data is encrypted in transit (HTTPS/TLS). Data may be processed in the United States and other countries where Google operates.

6. Retention and deletion

• You can delete individual items at any time. As a safeguard against accidents, deleted (still encrypted) items are kept for 30 days in a recycle bin the app cannot read, then removed automatically.
• Delete your account and all cloud data in the app (Account settings), or follow these instructions, or email us. Your encrypted cloud data is then removed, apart from the 30-day recycle bin and routine backups, which expire on their own.
• Signing out erases all app data from the device.
• Diagnostics are kept for the periods set by Firebase (typically up to 90 days).

7. Permissions

Camera (scan receipts and price tags), photos (choose receipts and profile picture), microphone (optional voice entry, turned into text by your phone's speech recognition service; the app does not keep or upload audio), notifications (reminders, invites, shared-space updates, monthly prices), and, only if you turn on Auto-add purchases, notification access for the bank, card and wallet apps you pick (see "Auto-add purchases" above). Each is used only for that feature and can be refused; the rest of the app works. The app does not use your location.

8. Your rights

Depending on where you live (for example under GDPR, UK GDPR or CCPA) you may have the right to access, correct, export or delete your data and to object to processing. You can export your data as CSV in the app and delete it as described above; for anything else, email us and we will reply within 30 days. You may also complain to your local data protection authority.

9. Children

Spence is not directed at children under 13 (or the age required in your country) and we do not knowingly collect their data.

10. Changes and contact

If we change this policy in a material way we will update the date above and notify you in the app. Questions: spence@spenceapp.com.

11. This website

spenceapp.com uses Google Analytics to count visits, but only if you accept the choice shown on your first visit: nothing is loaded and nothing is stored before that, your IP address is not kept, advertising features are off, and you can change your mind any time from "Privacy choices" in the footer.